CVE-2026-104652 Overview
CVE-2026-104652 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Envira Gallery WordPress plugin before version 1.16.1. The plugin fails to sanitize and escape a gallery item identifier before rendering it inside an image tag attribute. Authenticated users with the Author role or above can inject arbitrary web scripts that execute when any visitor renders a page embedding the affected gallery. The injected payload runs in the browser context of the visitor, including administrators, enabling session theft, privilege escalation workflows, and arbitrary actions on behalf of higher-privileged accounts.
Critical Impact
Authenticated Authors can store JavaScript that executes in administrator browsers, enabling account takeover of WordPress sites running Envira Gallery before 1.16.1.
Affected Products
- Envira Gallery WordPress plugin versions prior to 1.16.1
- WordPress installations where Author-or-above accounts exist and can create gallery items
- Public-facing pages that embed Envira Gallery shortcodes or blocks
Discovery Timeline
- 2026-10-07 - CVE-2026-104652 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-104652
Vulnerability Analysis
The flaw is a stored XSS in the Envira Gallery plugin's rendering path for gallery items. When the plugin outputs an image tag, it inserts a gallery item identifier directly into an HTML attribute without applying WordPress escaping helpers such as esc_attr(). An attacker with Author privileges can set this identifier to an attribute-breaking payload that terminates the attribute and injects an event handler or additional attributes.
Because the payload is persisted with the gallery and executed on any page embedding it, the vulnerability extends the attacker's reach from a low-trust Author account to any site visitor. Administrators previewing or managing content become high-value targets, as script execution in an admin session enables plugin installation, user creation, and content modification.
Root Cause
The root cause is missing output escaping on a user-controllable value rendered inside an HTML attribute context. The plugin assumes the identifier is well-formed and does not pass it through esc_attr() or an equivalent sanitizer prior to concatenation into the image tag. This is a classic failure to apply contextual output encoding at the sink.
Attack Vector
Exploitation requires an authenticated session with Author role or higher and user interaction from a visitor who loads a page containing the malicious gallery. The attacker creates or edits a gallery item, supplies a crafted identifier that escapes the attribute delimiter, and injects a JavaScript event handler. When any visitor, including an administrator, views the embedding page, the browser executes the attacker's script under the site's origin.
No verified public exploit code is available. Technical details are described in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-104652
Indicators of Compromise
- Envira Gallery item records containing attribute-breaking characters such as ", >, or event handler strings like onerror= and onload= in identifier fields
- Unexpected administrator-initiated actions following gallery page views, including new administrator accounts or plugin installations
- Outbound requests from administrator browsers to attacker-controlled domains sourced from pages embedding Envira galleries
Detection Strategies
- Query the WordPress database for Envira Gallery post meta and configuration values containing HTML attribute delimiters or JavaScript event handlers
- Review web server access logs for POST requests from Author-level accounts to gallery creation and edit endpoints followed by anomalous admin activity
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from gallery-embedding pages
Monitoring Recommendations
- Monitor WordPress audit logs for Author-role users modifying gallery items, especially accounts with recent registration
- Alert on administrator session activity that creates new privileged users or installs plugins within short windows of visiting content pages
- Track outbound HTTP requests from browsers rendering editor and preview pages for unknown third-party destinations
How to Mitigate CVE-2026-104652
Immediate Actions Required
- Upgrade the Envira Gallery plugin to version 1.16.1 or later on all WordPress sites
- Audit all accounts with Author role or higher and remove or demote unused or untrusted users
- Review existing gallery items for suspicious identifier values and remove any containing script payloads
Patch Information
The vendor has addressed the issue in Envira Gallery version 1.16.1 by applying proper escaping to the gallery item identifier before output. Refer to the WPScan Vulnerability Report for the authoritative advisory and fixed version details.
Workarounds
- Restrict gallery creation and editing capabilities to trusted Editor and Administrator accounts using a role management plugin until patching is complete
- Deploy a Web Application Firewall (WAF) rule to block requests to gallery endpoints containing HTML attribute delimiters or JavaScript event handler keywords
- Enforce a strict Content Security Policy that disallows inline scripts and unapproved third-party script sources
# Update Envira Gallery via WP-CLI
wp plugin update envira-gallery-lite --version=1.16.1
wp plugin update envira-gallery --version=1.16.1
# Verify installed version
wp plugin get envira-gallery --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
